@mokoconsulting/mcp-mokosuite 1.0.0

package/Makefile

@@ -0,0 +1,70 @@
+# MCP Server Makefile
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+PROJECT_NAME := mcp-mokosuite
+PROJECT_VERSION := 1.0.0
+
+NPM := npm
+
+COLOR_RESET := \033[0m
+COLOR_GREEN := \033[32m
+COLOR_BLUE := \033[34m
+
+.PHONY: help
+help: ## Show this help message
+	@echo "$(COLOR_BLUE)$(PROJECT_NAME) v$(PROJECT_VERSION)$(COLOR_RESET)"
+	@echo ""
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  $(COLOR_BLUE)%-20s$(COLOR_RESET) %s\n", $$1, $$2}'
+	@echo ""
+
+.PHONY: install-deps
+install-deps: ## Install dependencies
+	@$(NPM) install
+	@echo "$(COLOR_GREEN)✓ Dependencies installed$(COLOR_RESET)"
+
+MOKO_PLATFORM ?= $(or $(wildcard ../mokocli),$(wildcard $(HOME)/mokocli),$(wildcard /opt/mokocli))
+MINIFY_SCRIPT := $(MOKO_PLATFORM)/build/minify.js
+
+.PHONY: minify
+minify: ## Minify CSS/JS assets
+	@echo "Minifying assets..."
+	@if [ -f "$(MINIFY_SCRIPT)" ]; then \
+		node "$(MINIFY_SCRIPT)" $(SRC_DIR); \
+	elif [ -f "scripts/minify.js" ]; then \
+		node scripts/minify.js; \
+	else \
+		echo "No minify script found"; \
+	fi
+
+.PHONY: build
+build: minify ## Build TypeScript
+	@$(NPM) run build
+	@echo "$(COLOR_GREEN)✓ Build complete$(COLOR_RESET)"
+
+.PHONY: dev
+dev: ## Watch and rebuild on changes
+	@$(NPM) run dev
+
+.PHONY: clean
+clean: ## Clean build artifacts
+	@rm -rf dist
+	@echo "$(COLOR_GREEN)✓ Cleaned$(COLOR_RESET)"
+
+.PHONY: setup
+setup: ## Run interactive setup wizard
+	@$(NPM) run setup
+
+.PHONY: start
+start: ## Start the MCP server
+	@$(NPM) run start
+
+.PHONY: lint
+lint: ## Run linter
+	@$(NPM) run lint
+
+.PHONY: ci
+ci: install-deps build ## Run CI pipeline
+	@echo "$(COLOR_GREEN)✓ CI pipeline complete$(COLOR_RESET)"
+
+.DEFAULT_GOAL := help

package/README.md

@@ -0,0 +1,83 @@
+# mcp-mokosuite
+
+![Language](https://img.shields.io/badge/language-TypeScript-3178C6?style=flat-square&logo=typescript&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square) ![Platform](https://img.shields.io/badge/platform-Node.js%20%7C%20MCP-339933?style=flat-square&logo=node.js&logoColor=white)
+
+Model Context Protocol (MCP) server for the **MokoSuite** platform. It lets AI assistants like Claude operate MokoSuite client sites through the MokoSuiteClient Joomla Web Services API — health, dashboards, extensions, plugins, snapshots, cache/updates, content sync, and (via HQ credentials) provisioning, remote login, and fleet-wide user operations.
+
+## Features
+
+- **24 tools** across the platform surface — reads, actions, and RSA-signed remote-control.
+- **Multi-site** — every named connection is a MokoSuite site (or the HQ control plane); all tools accept an optional `connection` parameter.
+- **Two credential tiers** — a Joomla Web Services Bearer token for read/CRUD, plus an optional `health_api_token` + HQ RSA private key for the remote-control tier.
+- **Safety guards** — destructive fleet-wide operations require an explicit `confirm: true`.
+- **TypeScript-first**, ESM, `node:https` transport (reliable self-signed cert support).
+
+## Installation
+
+```bash
+npm install -g @mokoconsulting/mcp-mokosuite
+```
+
+Or run on demand with `npx`:
+
+```bash
+npx @mokoconsulting/mcp-mokosuite
+```
+
+Create `~/.mcp_mokosuite.json` (or point `$MOKOSUITE_CONFIG` at a file) — see [`config.example.json`](config.example.json):
+
+```json
+{
+  "defaultConnection": "moko-live",
+  "connections": {
+    "moko-live": { "baseUrl": "https://mokoconsulting.tech", "apiToken": "your-joomla-api-token" }
+  }
+}
+```
+
+- `apiToken` — a Joomla **Web Services** API token (Users → Manage → API Tokens) for the read/CRUD tools.
+- `healthApiToken` + `rsaPrivateKeyPath` + `keyVersion` *(optional)* — the site's `health_api_token` and HQ's RSA-2048 signing key, required only for the remote-control tools (provision-reset, remote-login, mass user ops).
+
+## Usage
+
+Register the server with your MCP client (e.g. Claude Code / Claude Desktop):
+
+```json
+{
+  "mcpServers": {
+    "mokosuite": { "command": "npx", "args": ["-y", "@mokoconsulting/mcp-mokosuite"] }
+  }
+}
+```
+
+Then ask the assistant to use the tools, e.g. *"check the health of the moko-dev site"* → `client_get_health`. Representative tools:
+
+| Tier | Tools |
+|---|---|
+| Foundation | `mokosuite_ping`, `list_connections`, `api_request` |
+| Reads | `client_get_health`, `client_get_dashboard`, `client_list_extensions`, `client_list_plugins`, `client_list_snapshots`, `client_list_users`, `client_export_users` |
+| Actions | `client_clear_cache`, `client_check_updates`, `client_install_extension`, `client_toggle_plugin`, `client_create_snapshot`, `client_reset_snapshot`, `client_sync_push` |
+| Remote-control (RSA-signed) | `client_provision_reset`, `client_remote_login`, `client_users_reset_passwords`, `client_users_reset_2fa`, `client_users_disable_all`, `client_users_enable_all`, `client_users_force_logout` |
+
+All tools target the default connection unless a `connection` argument names another site. Remote-control tools require the second credential tier and destructive ones require `confirm: true`.
+
+## Development
+
+```bash
+npm install       # install dependencies
+npm run build     # compile TypeScript to dist/
+npm run dev       # watch mode
+npm start         # run the compiled server
+```
+
+## Contributing
+
+Contributions follow [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoCLI/wiki/Home). See [CONTRIBUTING.md](CONTRIBUTING.md). Develop on feature branches, use `Authored-by: Moko Consulting` in commits, and open a PR to `main`.
+
+## License
+
+Licensed under the GNU General Public License v3.0 or later — see [LICENSE](LICENSE).
+
+---
+
+*[Moko Consulting](https://mokoconsulting.tech) — [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoCLI/wiki/Home)*

package/SECURITY.md

@@ -0,0 +1,34 @@
+<!--
+Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+SPDX-License-Identifier: GPL-3.0-or-later
+
+# FILE INFORMATION
+DEFGROUP: mcp-mokosuite.Documentation
+PATH: /SECURITY.md
+VERSION: 01.00.00
+BRIEF: Security policy and vulnerability disclosure
+-->
+
+# Security Policy
+
+## Supported Versions
+
+The latest published `@mokoconsulting/mcp-mokosuite` release receives security updates. Please upgrade before reporting issues against older versions.
+
+## Reporting a Vulnerability
+
+Do **not** open a public issue for security vulnerabilities. Instead, email **[hello@mokoconsulting.tech](mailto:hello@mokoconsulting.tech)** with:
+
+- a description of the vulnerability and its impact,
+- steps to reproduce (proof of concept if possible),
+- affected version(s).
+
+You can expect an acknowledgement within 5 business days and a remediation plan once the report is triaged. Please allow a reasonable disclosure window before making details public.
+
+## Handling Credentials
+
+This server connects to MokoSuite sites using Joomla Web Services API tokens and, for the remote-control tier, a `health_api_token` plus an RSA private key. Treat the config file (`~/.mcp_mokosuite.json`) and any key material as secrets:
+
+- never commit tokens, `health_api_token`s, or private keys to source control;
+- scope Joomla API tokens to the minimum required (`core.manage`);
+- the RSA private key is HQ-only — keep it off client machines that only need read access.

package/config.example.json

@@ -0,0 +1,21 @@
+{
+	"defaultConnection": "moko-live",
+	"connections": {
+		"moko-live": {
+			"baseUrl": "https://mokoconsulting.tech",
+			"apiToken": "your-joomla-api-token"
+		},
+		"cfurs": {
+			"baseUrl": "https://clarksvillefurs.com",
+			"apiToken": "your-joomla-api-token",
+			"healthApiToken": "site-health-api-token-64hex",
+			"rsaPrivateKeyPath": "/path/to/hq-signing-key.pem",
+			"keyVersion": 1
+		},
+		"local-dev": {
+			"baseUrl": "https://localhost",
+			"apiToken": "your-joomla-api-token",
+			"insecure": true
+		}
+	}
+}

package/dist/client.d.ts

@@ -0,0 +1,22 @@
+import type { ApiConnection, ApiResponse } from './types.js';
+export declare class ApiClient {
+    private readonly conn;
+    private readonly base_url;
+    private readonly headers;
+    private readonly insecure;
+    constructor(conn: ApiConnection);
+    get(endpoint: string, params?: Record<string, string>): Promise<ApiResponse>;
+    post(endpoint: string, body?: unknown): Promise<ApiResponse>;
+    put(endpoint: string, body: unknown): Promise<ApiResponse>;
+    patch(endpoint: string, body: unknown): Promise<ApiResponse>;
+    delete(endpoint: string): Promise<ApiResponse>;
+    /**
+     * Remote-control tier: swap the auth to the site's `health_api_token` and attach the
+     * RSA signature headers HQ uses, then issue a GET or POST. Requires the connection to
+     * carry `healthApiToken` + `rsaPrivateKeyPath`.
+     */
+    remoteControl(method: 'GET' | 'POST', endpoint: string, body?: unknown, params?: Record<string, string>): Promise<ApiResponse>;
+    private buildUrl;
+    private request;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -0,0 +1,124 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mcp-mokosuite.Client
+ * INGROUP: mcp-mokosuite
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mcp-mokosuite
+ * PATH: /src/client.ts
+ * VERSION: 01.00.00
+ * BRIEF: HTTP client for the MokoSuite (Joomla Web Services) API
+ */
+import * as https from 'node:https';
+import * as http from 'node:http';
+import { buildRemoteControlHeaders } from './signing.js';
+// ── Endpoint conventions ────────────────────────────────────────────────
+// Joomla Web Services live under /api/index.php; MokoSuiteClient routes are
+// registered at /v1/mokosuiteclient/* (see MSC_BASE in index.ts).
+const API_PREFIX = '/api/index.php';
+const TIMEOUT_MS = 30_000;
+// ────────────────────────────────────────────────────────────────────────
+export class ApiClient {
+    conn;
+    base_url;
+    headers;
+    insecure;
+    constructor(conn) {
+        this.conn = conn;
+        this.base_url = conn.baseUrl.replace(/\/+$/, '') + API_PREFIX;
+        // Read/CRUD tier: Joomla Web Services authenticate via a Bearer API token.
+        this.headers = {
+            'Authorization': `Bearer ${conn.apiToken}`,
+            'Content-Type': 'application/json',
+            'Accept': 'application/vnd.api+json',
+        };
+        this.insecure = conn.insecure ?? false;
+    }
+    async get(endpoint, params) {
+        return this.request(this.buildUrl(endpoint, params), 'GET');
+    }
+    async post(endpoint, body) {
+        return this.request(this.buildUrl(endpoint), 'POST', body);
+    }
+    async put(endpoint, body) {
+        return this.request(this.buildUrl(endpoint), 'PUT', body);
+    }
+    async patch(endpoint, body) {
+        return this.request(this.buildUrl(endpoint), 'PATCH', body);
+    }
+    async delete(endpoint) {
+        return this.request(this.buildUrl(endpoint), 'DELETE');
+    }
+    /**
+     * Remote-control tier: swap the auth to the site's `health_api_token` and attach the
+     * RSA signature headers HQ uses, then issue a GET or POST. Requires the connection to
+     * carry `healthApiToken` + `rsaPrivateKeyPath`.
+     */
+    async remoteControl(method, endpoint, body, params) {
+        const signed = {
+            ...buildRemoteControlHeaders(this.conn),
+            'Authorization': `Bearer ${this.conn.healthApiToken}`,
+        };
+        return this.request(this.buildUrl(endpoint, params), method, body, signed);
+    }
+    buildUrl(endpoint, params) {
+        const path = endpoint.startsWith('/') ? endpoint : `/${endpoint}`;
+        const url = new URL(`${this.base_url}${path}`);
+        if (params) {
+            for (const [key, value] of Object.entries(params)) {
+                url.searchParams.set(key, value);
+            }
+        }
+        return url.toString();
+    }
+    request(url, method, body, extraHeaders) {
+        return new Promise((resolve, reject) => {
+            const parsed = new URL(url);
+            const is_https = parsed.protocol === 'https:';
+            const transport = is_https ? https : http;
+            const options = {
+                hostname: parsed.hostname,
+                port: parsed.port || (is_https ? 443 : 80),
+                path: parsed.pathname + parsed.search,
+                method,
+                headers: { ...this.headers, ...(extraHeaders ?? {}) },
+                timeout: TIMEOUT_MS,
+            };
+            if (this.insecure && is_https) {
+                options.rejectUnauthorized = false;
+            }
+            const payload = body !== undefined ? JSON.stringify(body) : undefined;
+            if (payload) {
+                options.headers['Content-Length'] = Buffer.byteLength(payload).toString();
+            }
+            const req = transport.request(options, (res) => {
+                const chunks = [];
+                res.on('data', (chunk) => chunks.push(chunk));
+                res.on('end', () => {
+                    const raw = Buffer.concat(chunks).toString('utf-8');
+                    let data;
+                    try {
+                        data = JSON.parse(raw);
+                    }
+                    catch {
+                        data = raw;
+                    }
+                    resolve({ status: res.statusCode ?? 0, data });
+                });
+            });
+            req.on('error', (err) => reject(err));
+            req.on('timeout', () => {
+                req.destroy();
+                reject(new Error('Request timed out'));
+            });
+            if (payload) {
+                req.write(payload);
+            }
+            req.end();
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/config.d.ts

@@ -0,0 +1,4 @@
+import type { ApiConfig, ApiConnection } from './types.js';
+export declare function loadConfig(): Promise<ApiConfig>;
+export declare function getConnection(config: ApiConfig, name?: string): ApiConnection;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -0,0 +1,53 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mcp-mokosuite.Config
+ * INGROUP: mcp-mokosuite
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mcp-mokosuite
+ * PATH: /src/config.ts
+ * VERSION: 01.00.00
+ * BRIEF: Configuration loader for MokoSuite MCP connections
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+// ── Customize this ──────────────────────────────────────────────────────
+// Change the filename to match your project (e.g. ".dolibarr-api-mcp.json")
+const CONFIG_FILENAME = '.mcp_mokosuite.json';
+// Change the env var name to match your project
+const CONFIG_ENV_VAR = 'MOKOSUITE_CONFIG';
+// ────────────────────────────────────────────────────────────────────────
+export async function loadConfig() {
+    const config_path = process.env[CONFIG_ENV_VAR]
+        ? resolve(process.env[CONFIG_ENV_VAR])
+        : resolve(homedir(), CONFIG_FILENAME);
+    try {
+        const raw = await readFile(config_path, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!parsed.connections || Object.keys(parsed.connections).length === 0) {
+            throw new Error('No connections defined in config');
+        }
+        return {
+            connections: parsed.connections,
+            defaultConnection: parsed.defaultConnection ?? Object.keys(parsed.connections)[0],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to load config from ${config_path}: ${message}\n` +
+            `Create ${config_path} — see config.example.json for format.`);
+    }
+}
+export function getConnection(config, name) {
+    const key = name ?? config.defaultConnection;
+    const conn = config.connections[key];
+    if (!conn) {
+        throw new Error(`Connection "${key}" not found. Available: ${Object.keys(config.connections).join(', ')}`);
+    }
+    return conn;
+}
+//# sourceMappingURL=config.js.map

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mcp-mokosuite.Server
+ * INGROUP: mcp-mokosuite
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mcp-mokosuite
+ * PATH: /src/index.ts
+ * VERSION: 01.00.00
+ * BRIEF: MCP server entry point — registers MokoSuite (Layer 0 / Platform) tools
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { loadConfig, getConnection } from './config.js';
+import { ApiClient } from './client.js';
+import { hasRemoteControl } from './signing.js';
+/** Base path for MokoSuiteClient Web Services (appended after /api/index.php). */
+const MSC = '/v1/mokosuiteclient';
+let config;
+function clientFor(connection) {
+    return new ApiClient(getConnection(config, connection));
+}
+function formatResponse(res) {
+    if (res.status >= 400) {
+        return {
+            content: [{ type: 'text', text: `Error: HTTP ${res.status}: ${JSON.stringify(res.data, null, 2)}` }],
+        };
+    }
+    return {
+        content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+    };
+}
+function text(message) {
+    return { content: [{ type: 'text', text: message }] };
+}
+// ── Shared parameter definitions ────────────────────────────────────────
+const ConnectionParam = {
+    connection: z.string().optional().describe('Named MokoSuite site/connection from config (uses default if omitted)'),
+};
+const ConfirmParam = {
+    confirm: z.boolean().describe('Must be true — this operates on ALL users of the target site and is not reversible'),
+};
+function requireConfirm(confirm) {
+    return confirm ? null : text('Refused: set `confirm: true` to run this fleet-wide destructive operation.');
+}
+// ── Server ──────────────────────────────────────────────────────────────
+const server = new McpServer({
+    name: 'mcp-mokosuite',
+    version: '1.0.0',
+});
+// ════════════════════════════════════════════════════════════════════════
+// FOUNDATION — connectivity & generic access
+// ════════════════════════════════════════════════════════════════════════
+server.tool('mokosuite_ping', 'Check reachability of a MokoSuite site (calls its dashboard endpoint and reports HTTP status).', { ...ConnectionParam }, async ({ connection }) => {
+    const client = clientFor(connection);
+    try {
+        const res = await client.get(`${MSC}/dashboard`);
+        return text(`Reachable — HTTP ${res.status} from ${MSC}/dashboard`);
+    }
+    catch (err) {
+        return text(`Unreachable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
+server.tool('list_connections', 'List configured MokoSuite connections, their role, and which credential tiers are available.', {}, async () => {
+    const lines = Object.entries(config.connections).map(([name, conn]) => {
+        const is_default = name === config.defaultConnection ? ' (default)' : '';
+        const role = conn.role ?? 'client';
+        const tiers = ['read/CRUD'];
+        if (hasRemoteControl(conn))
+            tiers.push('remote-control');
+        return `  ${name}${is_default} [${role}]: ${conn.baseUrl}  — tiers: ${tiers.join(', ')}`;
+    });
+    return text(`Configured MokoSuite connections:\n${lines.join('\n')}`);
+});
+server.tool('api_request', 'Make a raw request to any MokoSuite/Joomla Web Services endpoint (escape hatch). Path is relative to /api/index.php.', {
+    method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']).describe('HTTP method'),
+    endpoint: z.string().describe('Path relative to /api/index.php (e.g. "/v1/mokosuiteclient/health")'),
+    body: z.record(z.string(), z.unknown()).optional().describe('Request body for POST/PUT/PATCH'),
+    params: z.record(z.string(), z.string()).optional().describe('Query parameters'),
+    ...ConnectionParam,
+}, async ({ method, endpoint, body, params, connection }) => {
+    const client = clientFor(connection);
+    switch (method) {
+        case 'GET': return formatResponse(await client.get(endpoint, params));
+        case 'POST': return formatResponse(await client.post(endpoint, body));
+        case 'PUT': return formatResponse(await client.put(endpoint, body));
+        case 'PATCH': return formatResponse(await client.patch(endpoint, body));
+        case 'DELETE': return formatResponse(await client.delete(endpoint));
+    }
+});
+// ════════════════════════════════════════════════════════════════════════
+// LAYER 0 — Platform (MokoSuiteClient) — READS  (Joomla API token)
+// ════════════════════════════════════════════════════════════════════════
+server.tool('client_get_health', 'Get the full 16-check health diagnostics for a MokoSuite site (db, filesystem, cache, extensions, backup, security, ssl, cron, errors, content, users, mail, seo, template, config).', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/health`)));
+server.tool('client_get_dashboard', 'Get the summarized dashboard for a MokoSuite site (health summary, Joomla/PHP versions, plugin states).', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/dashboard`)));
+server.tool('client_list_extensions', 'List installed extensions on a MokoSuite site, with versions and available update info.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/extensions`)));
+server.tool('client_list_plugins', 'List the MokoSuite feature plugins on a site and their enabled/disabled state.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/plugins`)));
+server.tool('client_list_snapshots', 'List the baseline snapshots available on a MokoSuite site.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/snapshot`)));
+server.tool('client_list_users', 'List Joomla users on a MokoSuite site.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/users`)));
+server.tool('client_export_users', 'Export the users of a MokoSuite site.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSC}/users/export`)));
+// ════════════════════════════════════════════════════════════════════════
+// LAYER 0 — Platform — ACTIONS  (Joomla API token, core.manage)
+// ════════════════════════════════════════════════════════════════════════
+server.tool('client_clear_cache', 'Clear all Joomla caches and opcache on a MokoSuite site.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).post(`${MSC}/cache`)));
+server.tool('client_check_updates', 'Run the Joomla update finder on a MokoSuite site and report the number of available updates.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).post(`${MSC}/update`)));
+server.tool('client_install_extension', 'Install an extension on a MokoSuite site from a remote ZIP URL (64MB cap). Privileged — use trusted URLs only.', {
+    url: z.string().describe('HTTPS URL of the extension ZIP to install'),
+    ...ConnectionParam,
+}, async ({ url, connection }) => formatResponse(await clientFor(connection).post(`${MSC}/install`, { url })));
+server.tool('client_toggle_plugin', 'Enable or disable a MokoSuite feature plugin on a site by its extension id.', {
+    extension_id: z.number().describe('Joomla extension id of the plugin to toggle'),
+    ...ConnectionParam,
+}, async ({ extension_id, connection }) => formatResponse(await clientFor(connection).post(`${MSC}/plugins`, { task: 'toggle', extension_id })));
+server.tool('client_create_snapshot', 'Create a baseline snapshot on a MokoSuite site.', {
+    label: z.string().optional().describe('Optional label for the snapshot'),
+    ...ConnectionParam,
+}, async ({ label, connection }) => formatResponse(await clientFor(connection).post(`${MSC}/snapshot`, label ? { label } : {})));
+server.tool('client_reset_snapshot', 'Restore a named baseline snapshot on a MokoSuite site.', {
+    name: z.string().describe('Name of the baseline snapshot to restore'),
+    ...ConnectionParam,
+}, async ({ name, connection }) => formatResponse(await clientFor(connection).post(`${MSC}/reset`, { name })));
+server.tool('client_sync_push', 'Push a content sync from this MokoSuite site to a target site.', {
+    target: z.string().optional().describe('Target site identifier/URL for the sync (per site sync config)'),
+    ...ConnectionParam,
+}, async ({ target, connection }) => formatResponse(await clientFor(connection).post(`${MSC}/sync`, target ? { target } : {})));
+// ════════════════════════════════════════════════════════════════════════
+// LAYER 0 — Platform — REMOTE-CONTROL  (RSA-signed; requires HQ credentials)
+// ════════════════════════════════════════════════════════════════════════
+server.tool('client_provision_reset', 'Reset a MokoSuite site for a new client (clears hits, purges version history, regenerates tokens, revokes user tokens). RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/provision-reset`));
+});
+server.tool('client_remote_login', 'Get a one-time master login URL (60s TTL) for a MokoSuite site. RSA-signed remote-control tier.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/remote-login`)));
+server.tool('client_users_reset_passwords', 'Reset passwords for ALL users on a MokoSuite site. RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/reset-passwords`));
+});
+server.tool('client_users_reset_2fa', 'Reset two-factor authentication for ALL users on a MokoSuite site. RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/reset-2fa`));
+});
+server.tool('client_users_disable_all', 'Block ALL users on a MokoSuite site. RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/disable-all`));
+});
+server.tool('client_users_enable_all', 'Unblock ALL users on a MokoSuite site. RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/enable-all`));
+});
+server.tool('client_users_force_logout', 'Terminate ALL user sessions on a MokoSuite site. RSA-signed remote-control tier.', { ...ConfirmParam, ...ConnectionParam }, async ({ confirm, connection }) => {
+    const guard = requireConfirm(confirm);
+    if (guard)
+        return guard;
+    return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/force-logout`));
+});
+// ── Start Server ────────────────────────────────────────────────────────
+async function main() {
+    config = await loadConfig();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    process.stderr.write(`Fatal: ${err}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/signing.d.ts

@@ -0,0 +1,14 @@
+import type { ApiConnection } from './types.js';
+/**
+ * MokoSuiteClient's remote-control routes (provision-reset, remote-login, mass user ops)
+ * are `public` but require defence-in-depth headers that only MokoSuiteHQ can generate.
+ * HQ signs the payload `domain|timestamp|token` with its RSA-2048 private key (SHA-256);
+ * the client verifies against a baked-in public keyring within a 300-second freshness
+ * window. This reproduces that scheme so the MCP can act as HQ.
+ *
+ * @throws if the connection is missing the remote-control credentials or the key is unreadable.
+ */
+export declare function buildRemoteControlHeaders(conn: ApiConnection): Record<string, string>;
+/** True when a connection carries the credentials needed for the remote-control tier. */
+export declare function hasRemoteControl(conn: ApiConnection): boolean;
+//# sourceMappingURL=signing.d.ts.map